Crate secrets_engine_m365 

Microsoft 365 / Graph app-only access tokens.

Microsoft is the provider that can be operated with no stored secret at all — a federated identity credential on the app registration lets a workload’s own OIDC token stand in for a client secret. It is also a provider whose issued tokens cannot be revoked, so the containment story is entirely TTL plus resource-level scoping.

See docs/delegation/microsoft-365.md for the mechanism and docs/delegation/setup/microsoft-365.md for the operator walkthrough.

Structs

M365Config

The app registration this engine authenticates as.

M365Engine

RoleConfig

What one consumer may mint.

Enums

CredentialKind

How the server proves it is the app registration.